A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.

Affected: npm: extend

Versions of `extend` prior to 3.0.2 (for 3.x) and 2.0.2 (for 2.x) are vulnerable to Prototype Pollution. The `extend()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects.

## Recommendation

If you're using `extend` 3.x upgrade to 3.0.2 or later. If you're using `extend` 2.x upgrade to 2.0.2 or later.

nodejs-debug: Regular expression Denial of Service nodejs-mime: Regular expression Denial of Service nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format nodejs-braces: Regular Expression Denial of Service (ReDoS) in lib/parsers.js lodash: Prototype pollution in utilities function hoek: Prototype pollution in utilities function nodejs-url-parse: incorrect hostname in url parsing nodejs-extend: Prototype pollution can allow attackers to modify object properties nodejs-stringstream: out-of-bounds read leading to uninitialized memory exposure nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS lodash: uncontrolled resource consumption in Data handler causing denial of service nodejs-yargs-parser: prototype pollution vulnerability nodejs-lodash: prototype pollution in zipObjectDeep function nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function nodejs-highlight-js: prototype pollution via a crafted HTML code block urijs: Hostname spoofing via backslashes in URL python-pillow: Buffer over-read in PCX image reader python-pillow: decoding crafted YCbCr files could result in heap-based buffer overflow browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS) nodejs-postcss: Regular expression denial of service during source map parsing no…

Affected: Ubuntu:16.04:LTS: node-extend, Ubuntu:18.04:LTS: node-extend

A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.